Executive brief
Weblate has an arbitrary file read via symbolic links
Affected products
- PyPI weblate
Junglewise Threat Intelligence
CVE-2025-68279: PYSEC-2026-2040 - Weblate has an arbitrary file read via symbolic links
CVE-2025-68279 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: weblate (PyPI). Vendors: PyPI.
Related threats
- Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did
- Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather
- PYSEC-2026-2037 - Weblate leaks information via screenshots
- PYSEC-2026-2042 - Weblate has improper validation upon invitation acceptance
- PYSEC-2026-2036 - Weblate has a long session expiry when verifying second factor